From cdffc4db54e7f385bd2a283f91ae2e65b1268bd7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Tue, 28 May 2013 16:44:47 +0200 Subject: [FIX] project_issue: fixed write of date_action_last: it is possible to post a message without having access to write access rights on an issue, therefore using SUPERUSER_ID (e.g. portal user). [FIX] mail_message, mail, project, task, issue: it is now possible to have model-specific access rule checking for mail.message related acces right / rules. Task and issue allow to create mail.message when the user has a read access on the related document, not only when having write access. bzr revid: tde@openerp.com-20130528144447-3ivcom6r9x7q949b --- addons/project_issue/project_issue.py | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) (limited to 'addons/project_issue/project_issue.py') diff --git a/addons/project_issue/project_issue.py b/addons/project_issue/project_issue.py index 151bb2ab22e..bd5dff89413 100644 --- a/addons/project_issue/project_issue.py +++ b/addons/project_issue/project_issue.py @@ -19,6 +19,7 @@ # ############################################################################## +from openerp import SUPERUSER_ID from openerp.addons.base_status.base_stage import base_stage from openerp.addons.project.project import _TASK_STATE from openerp.addons.crm import crm @@ -492,6 +493,17 @@ class project_issue(base_stage, osv.osv): return [issue.project_id.message_get_reply_to()[0] if issue.project_id else False for issue in self.browse(cr, uid, ids, context=context)] + def check_mail_message_access(self, cr, uid, mids, operation, model_obj=None, context=None): + """ mail.message document permission rule: can post a new message if can read + because of portal document. """ + if not model_obj: + model_obj = self + if operation == 'create': + model_obj.check_access_rights(cr, uid, 'read') + model_obj.check_access_rule(cr, uid, mids, 'read', context=context) + else: + return super(project_issue, self).check_mail_message_access(cr, uid, mids, operation, model_obj=model_obj, context=context) + def message_get_suggested_recipients(self, cr, uid, ids, context=None): recipients = super(project_issue, self).message_get_suggested_recipients(cr, uid, ids, context=context) try: @@ -563,13 +575,10 @@ class project_issue(base_stage, osv.osv): """ if context is None: context = {} - res = super(project_issue, self).message_post(cr, uid, thread_id, body=body, subject=subject, type=type, subtype=subtype, parent_id=parent_id, attachments=attachments, context=context, content_subtype=content_subtype, **kwargs) - if thread_id: - self.write(cr, uid, thread_id, {'date_action_last': time.strftime(tools.DEFAULT_SERVER_DATETIME_FORMAT)}, context=context) - - return res + self.write(cr, SUPERUSER_ID, thread_id, {'date_action_last': time.strftime(tools.DEFAULT_SERVER_DATETIME_FORMAT)}, context=context) + return res class project(osv.Model): -- cgit v1.2.3